Privacy policy

While the operating company is being incorporated, the data controller is Michael N., the person responsible for publication (see the legal notice). For any question about your data or to exercise your rights, write to contact@askfor.music or use the Contact page.

• Account data: name, email address, role (organizer / artist), language, password (stored encrypted by our authentication provider).
• Profile data: for artists, stage name, description, city, fees, photos, links and categories; for organizers, information about the events you publish.
• Usage data: applications, bookings, messages exchanged on the Platform, reviews.
• Payment data: handled by Stripe. We do not store your card numbers; we keep only the information needed to track transactions (status, amount, transaction ID).
• Technical data: aggregated, anonymous traffic statistics (see "Cookies and analytics").

We process your data to:

• provide and secure the Service, manage your account and bookings (performance of the contract);
• process payments and prevent fraud (performance of the contract, legal obligation);
• send you useful notifications about your activity (legitimate interest);
• improve the Service and produce anonymous statistics (legitimate interest).

We do not sell your data. We rely on technical processors acting on our behalf:

• Supabase (Supabase Inc., United States): database, authentication and file storage, hosted in the European Union (Ireland).
• Stripe (Stripe Payments Europe, Ireland, and Stripe Inc., United States): payment processing.
• Vercel (Vercel Inc., United States): application hosting, run in Germany (Frankfurt) with a global delivery network, and analytics.
• Tizoo (Switzerland): mail server for sending emails.

Some data may be visible to other users where this is inherent to the Service (for example an artist's public profile, or the sharing of contact details between an organizer and an artist after a booking is accepted).

Your data is processed in Switzerland (emails), Ireland (database, payments), Germany (application) and may be processed in the United States (parent companies of Supabase, Stripe and Vercel, delivery network). The Federal Council recognises the European Union as providing adequate protection. For the United States, transfers rely on the Swiss-U.S. Data Privacy Framework where the provider is certified, and otherwise on standard contractual clauses.

• Account, profile, requests, messages, reviews: while your account is open. When it is closed, they are deleted, including the reviews you wrote.
• In-app notifications: 90 days after being read.
• Log of emails sent: 90 days, with message contents kept for 7 days only (to resend a lost email).
• Administration log: 24 months.
• Payment records (amount, date, status, transaction identifiers): 10 years, as required by Swiss accounting law (art. 958f CO).

You can close your account and download your data at any time from your profile, under "My account".

Under applicable law, you have the right to access, rectify, erase, restrict and object to the processing of your data, as well as the right to data portability. You can exercise these rights via the Contact page.

You also have the right to lodge a complaint with the competent data protection authority (in Switzerland, the Federal Data Protection and Information Commissioner).

AskFor.Music only uses strictly necessary cookies, without a consent banner:

• sb-…: your sign-in session (until you sign out);
• NEXT_LOCALE: the language you chose;
• afm_form: what you typed into a form, to show it again after an error (5 minutes).

During a payment, Stripe sets its own security cookies (such as "__stripe_mid" and "__stripe_sid") to prevent fraud. Audience and performance measurement (Vercel) is aggregated, with no tracking cookie or individual profiling for advertising purposes.

Artist profiles may show excerpts hosted by YouTube (Google), Spotify or SoundCloud. These players only load when you click on them: before that click, no data is sent to these services. Afterwards, they receive your IP address in particular and may set their own cookies, under their own privacy policies.

We implement appropriate technical and organisational measures (encrypted communications, access control, data isolation) to protect your data against unauthorised access, alteration or disclosure.

In the event of a data security breach likely to result in a high risk to your rights, we report it to the Federal Data Protection and Information Commissioner as soon as possible and inform you where necessary for your protection (art. 24 FADP).

This policy may be updated. The last-updated date appears at the top of the page; in the event of a material change, you will be informed by an appropriate means.